CVE-2026-46300: Linux Kernel Missing Variable Initialization Vulnerability
Linux Kernel
The Linux Kernel contains a variable initialization flaw that causes ESP input processing to decrypt shared fragments in place, allowing for unintended page-cache data modification. CISA added this vulnerability to its KEV catalog following confirmed exploitation.
why this severityExploitation in the wild is confirmed.
- CVSS
- 7.8
- EPSS
- 0.16 · top 3% · 2026-11-13
- KEV
- listed CISA KEV
- fix status
- Partly patched
- first report
- 28 Oct 2026
- last update
- 28 Oct 2026
- CVE ids
What to do
Apply mitigations according to vendor instructions.
Timeline · 1
Sources · 1
Advisories and databases
- 2026-10-28CVE-2026-46300: Linux Kernel — Linux Kernel Missing Initialization of a Variable VulnerabilityCISA · www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- No AI role
- categories
- General security
- severity
- 3 · Confirmed exploitation
- fix status
- Partly patched
- targets
- Not applicable
- owasp llm top 10
- no entry for these categories
- mitre atlas
- no technique for these categories
- dates
- happened 28 Oct 2026 · first reported 28 Oct 2026
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-29 00:20Z · updated 2026-10-29 00:20Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2026-46300: Linux Kernel Missing Variable Initialization Vulnerability https://gcdradar.vercel.app/incidents/cve-2026-46300-linux-kernel-missing-variable-initialization · AIR-2026-1625 · live - Lane: Patch now - Severity: 3 (Confirmed exploitation): Exploitation in the wild is confirmed. - Fix status: Partly patched - First reported: 2026-10-28 - AI role: No AI role - Products: Linux Kernel - CVE ids: CVE-2026-46300 - CVSS: 7.8 ## Summary The Linux Kernel contains a variable initialization flaw that causes ESP input processing to decrypt shared fragments in place, allowing for unintended page-cache data modification. CISA added this vulnerability to its KEV catalog following confirmed exploitation. ## What to do Apply mitigations according to vendor instructions. ## Latest updates - 2026-10-28: CVE-2026-46300: Linux Kernel — Linux Kernel Missing Initialization of a Variable Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300) ## Sources - 2026-10-28 CISA: CVE-2026-46300: Linux Kernel — Linux Kernel Missing Initialization of a Variable Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveDixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units
Patch now · Exploited · since 13 Nov 2026
- live8.6UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability
Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713
- liveCity of Osaka municipal systems City of Osaka suffers data breach impacting one million residents
Breaches & attacks · Real loss · since 13 Nov 2026
- liveUniversity of Texas at Arlington discloses data breach from cyberattack
Breaches & attacks · Exploited · since 13 Nov 2026
- livePDF viewers Genuine PDF Forgeries: Attacking Signature Verification via Human Factors
Research · since 13 Nov 2026
- liveAMD SEV-SNP Mior and Skyfall Attacks Target AMD SEV-SNP VMs
Research · since 13 Nov 2026